1. Module 3: Enabling Access to Internet Resources

2. Overview ISA Server 2004 as a Proxy Server
Configuring Multi-Networking on ISA Server
Configuring Access Rule Elements
Configuring Access Rules for Internet Access

3. Lesson: ISA Server 2004 as a Proxy Server
How ISA Server Enables Secure Access to Internet Resources
Why Use a Proxy Server?
How Does a Forward Web Proxy Server Work?
What Is a Reverse Web Proxy Server?
How to Configure ISA Server as a Proxy Server
DNS Configuration for Internet Access
How to Configure Web Chaining
How to Configure Dial-Up Connections

4. How ISA Server Enables Secure Access to Internet Resources
Is the …
User allowed access?
Computer allowed access?
Protocol allowed?
Destination allowed?
Content allowed?
ISA Server
Web Server
Proxy Server

5. Why Use a Proxy Server? Improved Internet access security:
ISA Server
Web Server
Improved Internet access security:
User authentication
Filtering client requests
Content inspection
Logging user access
Hiding the internal network details
Improved Internet access performance

6. How Does a Forward Web Proxy Server Work?
Is the …
User allowed access?
Protocol allowed?
Destination allowed? 3 6 1 5 2 4
ISA Server
Web Server

7. What Is a Reverse Web Proxy Server?
Is the …
Request allowed?
Protocol allowed?
Destination allowed?
Web Server 3
DNS Server 4 5 2 1
ISA Server 6

8. How to Configure ISA Server as a Proxy Server

9. DNS Configuration for Internet Access
If no internal DNS server is available to resolve Internet addresses, configure the ISA Server clients to use an Internet DNS server
Configure ISA Server clients to use an internal DNS server if the DNS server can resolve Internet addresses
ISA Server can proxy DNS requests for Web proxy and Firewall clients but not for SecureNAT clients
ISA Server includes a DNS cache that caches the results of all DNS lookups performed through ISA Server

10. How to Configure Web Chaining
Internet
Branch Office
Branch Office
Head Office

11. How to Configure Dial-Up Connections
Enable dial-up for connections to this network
Logon using this account
Use this dial-up connection

12. Practice: Configuring ISA Server as a Web Proxy Server
Configuring the proxy server settings on ISA Server
Den-ISA-01
Internet
Den-DC-01

13. Lesson: Configuring Multi-Networking on ISA Server
How Does ISA Server 2004 Support Multiple Networks?
Default Networks Enabled in ISA Server
About Network Objects
How to Create and Modify Network Objects
What Are Network Rules?

14. How Does ISA Server 2004 Support Multiple Networks?
Support any Number of Networks
VPN Networks Represented as Networks
Dynamic Network Membership
Per Network Rules
Per Network Policies
Network Sets
Internet
VPN
Perimeter1
LAN1
LAN2
Perimeter2

15. Default Networks Enabled in ISA Server
Includes
Local Host
The ISA Server
Default External
All IP addresses not associated with another network
Internal
All IP addresses specified as internal during installation
VPN Clients
All IP addresses for currently connected VPN clients
Quarantined VPN Clients
All IP addresses of connected VPN clients that have not cleared quarantine

16. About Network Objects Network Object Includes Network
All computers connected to a single network interface
Network Set
One or more networks
Computer
A single computer identified by an IP address
Computer Set
All computers included in specified computer, subnet or address range objects
Address Range
All computers identified by continuous IP addresses
Subnet
All computers on a specified subnet
URL Set
All specified URLs
Domain Name Set
All specified domain names
Web Listener
The IP address on which the ISA Server listens for connections

17. How to Create and Modify Network Objects
Click Firewall Policy, Toolbox, then Network Objects
Click Networks, then Networks or Network Sets

18. What Are Network Rules? Route connection: NAT connection:
A route relationship is bidirectional
If a routed relationship is defined from network A to network B, a routed relationship also exists from network B to network A
NAT connection:
A NAT relationship is directional
Addresses from the source network are always translated when passing through ISA Server

19. Practice: Managing Network Objects
Configuring a new network on ISA Server
Configuring a new network rule on ISA Server
Configuring a new computer network object on ISA Server
Den-ISA-01
Internet
Den-DC-01

20. Lesson: Configuring Access Rule Elements
What Are Access Rule Elements?
How to Configure Protocol Elements
How to Configure User Elements
How to Configure Content Type Elements
How to Configure Schedule Elements
How to Configure Domain Name Sets and URL Sets

21. What Are Access Rule Elements?
Used to Configure
Protocols
The protocols that will be allowed or denied by an access rule
Users
The users that will be allowed or denied by an access rule
Content Types
The content type that will be allowed or denied by an access rule
Schedules
The time of day when Internet access will be allowed or denied by an access rule
Network Objects
The computers or destinations that will be allowed or denied by an access rule

22. How to Configure Protocol Elements

23. How to Configure User Elements

24. How to Configure Content Type Elements
Define the MIME types and file extensions to include

25. How to Configure Schedule Elements
Define the times when this schedule is active or inactive

26. How to Configure Domain Name Sets and URL Sets
Use this to configure
access to an entire
domain
Use this to configure
access to a URL

27. Practice: Configuring Firewall Rule Elements
Configuring a new user set
Configuring a new content type element
Configuring a new schedule element
Configuring a new URL set
Den-ISA-01
Internet
Den-DC-01

28. Lesson: Configuring Access Rules for Internet Access
What Are Access Rules?
How Network Rules and Access Rules Are Applied
About Authentication and Internet Access
How to Configure Access Rules
How to Configure HTTP Policy
How to Troubleshoot Access to Internet Resources

29. What Are Access Rules? Access rules always define: Destination Network
Destination IP
Destination Site
action on traffic from user from source to destination with conditions
Allow
Deny
User
Protocol
IP Port/Type
Source network
Source IP
Schedule
Content Type

30. How Network Rules and Access Rules Are Applied3 4 5 1 2 6
ISA Server
Web Server
Domain Controller

31. About Authentication and Internet Access
Authentication and ISA Server Clients
Authentication Methods
Basic authentication
Digest authentication
Integrated Windows authentication
Digital certificates authentication
RADIUS authentication
RSA SecureID authentication

32. How to Configure Access Rules

33. How to Configure HTTP Policy
Configure additional filtering options
Configure maximum header length
Configure maximum payload length
Configure maximum URL and query length

34. Practice: Managing Access Rules
Creating a DNS Lookup Rule
Creating a Managers Access Rule
Testing Internet Access
Den-ISA-01
Internet
Den-Clt-01
Den-DC-01

35. How to Troubleshoot Access to Internet Resources
To troubleshoot Internet access issues:
Check for DNS name resolution
Determine the extent of the problem
Review access rule objects and access rule configuration
Review access rule order
Check access rule authentication
Use ISA Server logging to determine which access rule is granting or denying access

36. Lab: Enabling Access to Internet Resources
Exercise 1: Configuring ISA Server Access Rule Elements
Exercise 2: Configuring ISA Server Access Rules
Exercise 3: Testing ISA Server Access Rules
Den-ISA-01
Internet
Den-DC-01
Den-ISA-02